376867 - crash on Minefield shutdown [@ 0xffffffdc][@ js_GC()]

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Tony Mechelynck [:tonymec]]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a4pre) Gecko/20070407 Minefield/3.0a4pre
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a4pre) Gecko/20070407 Minefield/3.0a4pre

TB31001200E


Reproducible: Didn't try

Actual Results:  
crash

Expected Results:  
no crash

Incident ID: 31001200
Stack Signature	0xffffffdc 1d57c806
Product ID	FirefoxTrunk
Build ID	2007040704
Trigger Time	2007-04-08 13:02:31.0
Platform	LinuxIntel
Operating System	Linux 2.6.18.8-0.1-default
Module	
URL visited	
User Comments	shutting down Minefield
Since Last Crash	10 sec
Total Uptime	10 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	N/A
Stack Trace 	
0xffffffdc
js_GC()  [mozilla/js/src/jsgc.c, line 3120]
js_DestroyContext()  [mozilla/js/src/jscntxt.c, line 431]
JS_DestroyContext()  [mozilla/js/src/jsapi.c, line 985]
nsXPConnect::ReleaseJSContext()  [mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 1781]
nsJSContext::~nsJSContext()  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1008]
nsJSContext::Release()  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1046]
nsCOMPtr_base::assign_with_AddRef()  [mozilla/xpcom/build/nsCOMPtr.cpp, line 531]
nsXBLDocGlobalObject::SetContext()  [mozilla/content/xbl/src/nsXBLDocumentInfo.cpp, line 276]
nsXBLDocGlobalObject::SetScriptContext()  [mozilla/content/xbl/src/nsXBLDocumentInfo.cpp, line 284]
nsXBLDocumentInfo::~nsXBLDocumentInfo()  [mozilla/content/xbl/src/nsXBLDocumentInfo.cpp, line 909]
nsXBLDocumentInfo::Release()  [mozilla/content/xbl/src/nsXBLDocumentInfo.cpp, line 479]
nsCOMPtr_base::~nsCOMPtr_base()  [mozilla/xpcom/build/nsCOMPtr.cpp, line 81]
nsBaseHashtableET<nsURIHashKey, nsCOMPtr<nsIXBLDocumentInfo> >::~nsBaseHashtableET<nsURIHashKey, nsCOMPtr<nsIXBLDocumentInfo> >()
PL_DHashTableRawRemove()  [mozilla/xpcom/build/pldhash.c, line 694]
PL_DHashTableEnumerate()  [mozilla/xpcom/build/pldhash.c, line 728]
nsXULPrototypeCache::Flush()  [mozilla/content/xul/document/src/nsXULPrototypeCache.cpp, line 245]
nsDOMScriptObjectFactory::Observe()  [mozilla/dom/src/base/nsDOMScriptObjectFactory.cpp, line 269]
nsObserverList::NotifyObservers()  [mozilla/xpcom/ds/nsObserverList.cpp, line 127]
nsObserverService::NotifyObservers()  [mozilla/xpcom/ds/nsObserverService.cpp, line 181]
NS_ShutdownXPCOM_P()  [mozilla/xpcom/build/nsXPComInit.cpp, line 1061]
ScopedXPCOMStartup::~ScopedXPCOMStartup()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 778]
XRE_main()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 846]
main()  [mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x15f9c (0xb733bf9c)

Comment 1

[Tony Mechelynck [:tonymec]]

happened again on next shutdown, TB31002484Z

I'll disable crash recovery to see if anything changes.

Comment 2

[Tony Mechelynck [:tonymec]]

(In reply to comment #1)
[...]
> I'll disable crash recovery to see if anything changes.
> 

It didn't, TB31002818Y

Next I'm going to try the next build (20070408).

Comment 3

[Tony Mechelynck [:tonymec]]

looks more and more systematic: TB31010985Q
without -no-remote: TB31011048G
not on clean profile

the offending profile and my profiles.ini have now been uploaded to http://users.skynet.be/antoine.mechelynck/other/profiles.tar.gz
(8MB)

Comment 4

[Tony Mechelynck [:tonymec]]

(In reply to comment #3)
[...]
> the offending profile and my profiles.ini have now been uploaded to
> http://users.skynet.be/antoine.mechelynck/other/profiles.tar.gz
> (8MB)

Note: the files cookies.txt and signons2.txt in that tarball have been made zero-length for security reasons. I hope this slight "tampering" won't interfere with bug reproducibility.

Comment 5

[Samuel Sidler (old account; do not CC)]

Tony, are you still seeing this with the latest nightly and a clean profile? Or is this specific to the profile you linked to in comment 3?

Comment 6

[Tony Mechelynck [:tonymec]]

(In reply to comment #5)
> Tony, are you still seeing this with the latest nightly and a clean profile?

At least, not every time: with yesterday's (or Friday's?) Minefield loaded as "./firefox -no-remote -P clean" then Ctrl-W once the page ("Congratulations! You've installed a trunk version") was displayed, it didn't crash.

Looking back at comment #3 I see it did _not_ happen on a clean profile even then.

> Or
> is this specific to the profile you linked to in comment 3?
> 

I've got to go now but I'll check this this afternoon with the then-latest build and my "testing" profile.

Comment 7

[Samuel Sidler (old account; do not CC)]

Yeah, if it's something specific to that profile, please isolate what it is so we can determine what the cause might be.

Comment 8

[Tony Mechelynck [:tonymec]]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a5pre) Gecko/20070429 Minefield/3.0a5pre - Build ID: 2007042904

closed without crash this time, even on "testing" profile.

Comment 9

[Samuel Sidler (old account; do not CC)]

Tony, so can you not reproduce this at all any more using the same profile? Comment 8 makes it sound that way. If so, this might have been fixed in core somewhere, in which case we should resolve it as WFM.

Comment 10

[Tony Mechelynck [:tonymec]]

(In reply to comment #9)
> Tony, so can you not reproduce this at all any more using the same profile?
> Comment 8 makes it sound that way. If so, this might have been fixed in core
> somewhere, in which case we should resolve it as WFM.
> 

I haven't been using Minefield every day lately; I'll start trying every nightly for a while, and if the bug doesn't reoccur within a "reasonable" time span, we will have to assume that "something" fixed it between 3.0a4 and 3.0a5.

Comment 11

[Tony Mechelynck [:tonymec]]

Bug seems not to have reapeared. Please reopen if it bites you.